Coollabs Coolify vulnerabilities

• coollabs coolify Coolify has host header injection in forgot password CVE-2025-64425 8.5 HighJanuary 5, 2026
• coollabs coolify Colify has command injection vulnerability in project git source CVE-2025-64424 Public exploit 9.4 CriticalJanuary 5, 2026
• coollabs coolify Coolify has a Privilege Escalation - low privileged users can see and use admin invitation links CVE-2025-64423 7.7 HighJanuary 5, 2026
• coollabs coolify Rate-limit bypass on login via X-Forwarded-Host header CVE-2025-64422 5.5 MediumJanuary 5, 2026
• coollabs coolify Coolify has a privilege escalation - low privileged user can invite themselves as an admin user CVE-2025-64421 8.7 HighJanuary 5, 2026
• coollabs coolify Coolify members can see private key of root user CVE-2025-64420 10.0 CriticalJanuary 5, 2026
• coollabs coolify Coolify vulnerable to command injection via docker-compose.yaml parameters CVE-2025-64419 9.7 CriticalJanuary 5, 2026
• coollabs coolify Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpoint CVE-2025-59955 5.7 MediumJanuary 5, 2026
• coollabs coolify Coolify has Stored XSS in Project Name CVE-2025-59158 9.4 CriticalJanuary 5, 2026
• coollabs coolify Coolify has Git Repository RCE CVE-2025-59157 10.0 CriticalJanuary 5, 2026
• coollabs coolify Coolify has Docker Compose Injection issue CVE-2025-59156 9.4 CriticalJanuary 5, 2026
• coollabs coolify Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path CVE-2025-66213 9.4 CriticalDecember 23, 2025
• coollabs coolify Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filename CVE-2025-66212 9.4 CriticalDecember 23, 2025
• coollabs coolify Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename CVE-2025-66211 9.4 CriticalDecember 23, 2025
• coollabs coolify Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import CVE-2025-66210 9.4 CriticalDecember 23, 2025
• coollabs coolify Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup CVE-2025-66209 Public exploit 10.0 CriticalDecember 23, 2025
• coollabs coolify Coolify Stored Cross-Site Scripting (XSS) in Project Name Field CVE-2025-34157 Public exploit 9.4 CriticalAugust 27, 2025
• coollabs coolify Coolify Docker Compose Directive Injection in Application Deployment Workflow CVE-2025-34159 Public exploit 9.4 CriticalAugust 27, 2025
• coollabs coolify Coolify Git Repository Field Command Injection in Project Deployment Workflow CVE-2025-34161 Public exploit 9.4 CriticalAugust 27, 2025
• coollabs coolify Coolify Vulnerable to Reflected XSS on Tag Search CVE-2025-24025 1.3 LowJanuary 24, 2025
• coollabs coolify Coolify Vulnerable to Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE) CVE-2025-22612 10.0 CriticalJanuary 24, 2025
• coollabs coolify Coolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE) CVE-2025-22611 10.0 CriticalJanuary 24, 2025
• coollabs coolify Coolify Vulnerable to OAuth Secrets Leak CVE-2025-22610 5.7 MediumJanuary 24, 2025
• coollabs coolify Coolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE) CVE-2025-22609 10.0 CriticalJanuary 24, 2025
• coollabs coolify Coolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS) CVE-2025-22608 6.5 MediumJanuary 24, 2025
• coollabs coolify Coolify Vulnerable to GitHub / GitLab OAuth Secrets Leak CVE-2025-22607 4.7 MediumJanuary 24, 2025
• coollabs coolify Coolify Command Injection Vulnerability in Project Name CVE-2025-22606 8.5 HighJanuary 24, 2025
• coollabs coolify Coolify OS Command Injection Vulnerability in SSH Command Generation CVE-2025-22605 8.5 HighJanuary 24, 2025